Trump Administration Imposes New Sanctions on North Korean IT Fraud Network Targeting U.S. Corporate Operations
The Trump administration imposed new sanctions on Wednesday targeting a North Korean government‑run scheme that the Treasury Department says uses fraudulent identities to place IT workers inside legitimate U.S. companies, funneling their earnings toward Pyongyang’s weapons of mass destruction and ballistic‑missile programs. Ten individuals and one entity were sanctioned by the Office of Foreign Assets Control (OFAC) for help operating or financing the scheme. According to Treasury, the workers allegedly used stolen identities, falsified documents and deceptive personas to secure legitimate technology positions in the United States and allied countries. 
Under President Trump’s leadership, Treasury will continue to employ every available instrument to protect U.S. businesses from such malicious activities and ensure that those responsible are held accountable.
According to Treasury, the scheme involved North Korean workers who hid their identities and nationalities to obtain legitimate jobs with legitimate businesses. Once hired, the regime allegedly extracted most of the workers’ wages, producing hundreds of millions of dollars that Treasury alleges have financed North Korean weapons programs. The additional sanctions are directed at the individuals and the North Korean‑controlled entity that sustain the operation on behalf of the state.
Treasury Secretary Scott Bessent announced sanctions targeting a North Korean network accused of using fraudulent IT employment schemes to generate revenue for Pyongyang.(Chip Somodevilla/Getty Images / Getty Images)
The Treasury Department states that North Korea has leveraged overseas IT workers operating under false identities to generate revenue for the regime’s weapons programs. Treasury also reported that North Korean IT operatives deployed malware, illegally seized sensitive data and proprietary information, and extorted companies, creating risks for businesses worldwide. The network has employed cryptocurrency, advanced money‑laundering techniques and artificial‑intelligence tools to generate and move funds for the North Korean government, per Treasury. One sanctioned figure is Russian intermediary Vitold Viktorovich Obertas, accused of processing almost $2 million in cryptocurrency conversions and at least $1.25 million in other currency dealings for North Korean officials since January 2025. A second Russian national, Ilya Aleksandrovich Boykov, is alleged to have supported a previously sanctioned North Korean entity by facilitating cryptocurrency transactions valued at about $3.5 million since 2024.
Treasury had previously imposed separate sanctions on a different North Korean IT‑worker network in March. The sanctions freeze assets and interests held in the U.S. or by persons under U.S. control belonging to the sanctioned individuals and the entity, prohibiting U.S. persons from transacting with them unless authorized by OFAC.
